CVE-2026-111057 Details
Description
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.
A critical vulnerability in the Mercury framework, affecting versions 3.0.0 through 3.2.3, allows unauthenticated remote code execution. The issue arises from a missing comma in the BLOCKED_PATTERNS list, which causes the /lab and /api/terminals regular-expression literals to concatenate. This oversight enables requests to /api/terminals to bypass the anonymous endpoint blocklist and access Jupyter Server's terminal API. Exploiting this vulnerability provides an interactive operating-system shell, allowing execution of commands and access to data available to the Mercury process.
Users can upgrade to Mercury version 3.2.4, which addresses the vulnerability by adding the missing comma in the BLOCKED_PATTERNS list, ensuring proper blocking of the /api/terminals endpoint.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mljar/mercury/security/advisories/GHSA-f8c7-rwf9-fmgm | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/mljar/mercury/commit/8c467129037ee9df269d543ac217ffd33b97bf3f | [email protected] | Source CodeVendor |
| https://github.com/mljar/mercury/releases/tag/v3.2.4 | [email protected] | Release NotesVendor |
| https://github.com/mljar/mercury/security/advisories/GHSA-f8c7-rwf9-fmgm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-185 | Incorrect Regular Expression | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mercury | >= 3.0.0, <= 3.2.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |